#502 Introducing chameleon-rs

0:00Michael Kennedy Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds. This is episode 502, recorded Tuesday, October 27th, 2026. I'm Michael Kennedy.

0:11Calvin Hendryx-Parker And I'm Calvin Hendrix-Parker.

0:13Michael Kennedy And this episode is brought to you by us. If you have hard problems and you want a team you can trust, six feet up, just get in touch with Calvin and his team. They're doing amazing work, have been for 20 years. And if you want to learn some Python things, check out Talk Python Training, or you want to support the show over there at Talk Python, you can join membership.

0:32Michael Kennedy I have a few announcements from that as well. Connect with us on the socials, join the newsletter. All those things are on the website. Now, Calvin, it's been a week.

0:43Calvin Hendryx-Parker It's been a week. It's been a crazy week. I was traveling last week and all this hit while I was like either in the air or someplace exotic and strange. And PHP wasn't the only problem. So if you haven't heard, there was a PHP vulnerability, a major one last week. but that's not what I'm gonna talk about.

1:00Calvin Hendryx-Parker There were three different incidents also that affected the Python ecosystems that you all need to be aware of, and each of them in a different layer. So if you're not familiar with certificates and trust authorities and certificate authorities, there was a major vulnerability there in the trust layer.

1:18Calvin Hendryx-Parker There was also a vulnerability in the release pipeline again with LightLM. And then we had a C decoder issue that also led to an RCE with the Bratley library from I think what defined folks at Google. But let's dive in. So the eMadura CA, the keys got compromised. And so if you are using a Python older than the ones that are listed in the release right here, so I think it's like the.2, the.10, the.18, et cetera.

1:45Calvin Hendryx-Parker So basically 3.15 through 3.11 have all been patched, all been fixed and corrected. uv also has been fixed and updated, but you'll notice 3.10 not in the list. This is probably the first very large thing you need to watch out for for 3.9 and 3.10. You're not out of luck though, 'cause as long as you upgrade pip, I believe in certify, you'll get the latest bundles into your older versions of Python, but you gotta go do that yourself.

2:14Calvin Hendryx-Parker The other folks have done all the patching for you and made all the releases, so make sure you grab the latest versions of that. So why does this matter? When a certificate authority gets compromised like this, anyone who has these intermediate keys can basically mint certificates for any domain and any unpatched client who has these certificates in their CA will accept them as valid.

2:34Calvin Hendryx-Parker That means you are now susceptible to man in the middle attacks, basically reading and altering HTTPS traffic without a certificate warning, pretty bad stuff. If you consider like the world of Python and any version of Python before this, I had those intermediates in there, is now susceptible to reading in data from an untrusted source who will think it's trusted.

2:56Calvin Hendryx-Parker That's something everyone needs to be obviously on the hook for is making sure we all stay safe out there. So specifically like for Python, you could be downloading a susceptible package from PyPI and get something malicious because the credentials will, it looks real, but it's not. It's not real under the covers.

3:17Calvin Hendryx-Parker So that one, make sure you grab that latest release. Any existing virtual environments, you're going to need to make sure you upgrade those as well because they don't pick it up automatically. So if you did uv and upgraded your uv and did uv reinstall the Python version, any virtual environments created by that Python version still need to be updated.

3:34Calvin Hendryx-Parker So grab those, grab the latest and make sure you're safe.

3:37Michael Kennedy I actually noticed this. I didn't realize what it was for, but I noticed this because I have a script that just updates my homebrew, my NPM, my uv installed tools. And one of the things I've recently added, I've actually added two things, is one, just uv Python upgrade will do a build level upgrade of all of your installed Pythons without changing anything.

3:59Michael Kennedy And I think without breaking your virtual environments.

4:01Calvin Hendryx-Parker Nice. Yeah. And there's actually another fix in here too around some tar file stuff too. Yeah. Reject cookies in a negative assertion. Oh yeah. The tar file, tar filter. So there was more than just the CAs in this release, two other CVEs, but none as important the CA one that's bundled in here. The next one was on the build side.

4:21Calvin Hendryx-Parker The build side of this, which is Lite LLM again, is in the news. They got compromised back in March. They also have just gotten, the build got compromised. There was a version of Lite LLM that hit PyPI. It was up for about two hours, roughly 49,000 downloads. So, which is kind of sad. Folks should make sure that they are using the back off in their pipelines to install not the absolute latest and greatest.

4:48Calvin Hendryx-Parker You may want to wait, have it back off a few days and only grab versions that have been released for, well, at this point, if you had at least three hours in there, you had been fine and gotten the patched version of it. Docker images were also infected. They basically, and I think the big question here is why does this keep happening to LLM? I mean, it's twice this year.

5:08Calvin Hendryx-Parker The attackers are relentless. They are looking for exposed credentials and that's how they got in this time. They were able to find a key that didn't get revoked. There was a force push that included trying to fix for a key that got published accidentally but they never revoked that key. They were able to use that then to have the pipeline push keys like tokens from actual maintainers to a third-party source where they were able to collect them and then they were able to trigger the build pipeline, removing branch protections, et cetera, because it had admin privileges.

5:41Calvin Hendryx-Parker So again, make sure your build tokens have least privilege so they can't do things like remove branch protections in your GitHub repository. There's a lot of layers that go into this, but obviously now the LightLLM folks have hardened the pipeline once again to protect against this. But yeah, this was another one that the exploit was using the path hooks for Python start.

6:04Calvin Hendryx-Parker So for this to be exploited, but it was still SSH keys, cloud browser tokens, CI, AI tool credentials. They're all after your credentials so they can continue propagating these attacks into other places. So if you happen to have downloaded it within those two hours, that's unfortunate. Hopefully you've already patched and are on the way.

6:26Calvin Hendryx-Parker But I think the important bit here is to learn from how they're hardening their CI pipeline. If anyone is gonna be a good example for the best way to do it, going to be these folks now because they are they've gone through two rounds of this and and some pretty sophisticated versions of the attacks yikes yeah yikes is right uh the last one is even

6:45Michael Kennedy more a bit of a yikes i have a comment really quick oh go back let's go back really quick i just want a second uv exclude newer yes give it it's it feels a little like oh it's just security through obscurity but we're just gonna say well we're just not going and install stuff for like oh a day and How is that going to make any, it's a good practice.

7:05Michael Kennedy Almost all of these major ones we've reported on are like, it was out for three hours. It was out for two hours. It was out for half a day. Just let other people go first and find out. You know what I mean? Like you, you rarely need that much cutting edge. Yeah. And so just add that. If you use an uv, it's, you almost never need it.

7:26Michael Kennedy And the one thing that where you do maybe sometimes need it is if you're working on a project and you're pulling in something that you're publishing a PI PI and you're like, I want to actually just get, I want to publish it to PyPI and ship it so I can put the fix in now and test it. That's really frustrating because you don't want to wait a week to test out what you're doing.

7:42Michael Kennedy So you can just do exclude this package and just have an exclude list. They get instant and your stuff gets, everything else gets delayed and it's usually perfect. Yeah, so.

7:51Calvin Hendryx-Parker Follow these good practices and you will avoid a lot of heartache. I think is the moral of the story here for this one specifically.

7:58Michael Kennedy It's the tools are here. So just, you know, uv, I believe pip added this as well. it's like the cli is really different but it's the effect is the same yep and then the last one

8:08Calvin Hendryx-Parker major one from last week was the broccoli to shell uh so there's a bug in the broccoli decoder that lets crafted compressed data right past the end of a buffer which gets you a fun rce so if you want a remote shell in a box if you find one of these ones that's been installed with an old version of the brockley c decoder you will be on your way um so if you upgrade to the latest version of Brotley and Brotley CFFI, you'll be fine.

8:34Calvin Hendryx-Parker Everything's been patched, but you may not know you have this. A lot of web stacks, for example, may be bringing this in because they're using this to get a greater performance out of compression, for example. This is one of the main, one of the use cases for this specific library in there. So you may have gotten a transitive dependency brought in that brought this in.

8:57Calvin Hendryx-Parker One nice thing is that if you just uninstall the Bratley package and I believe liburl3, other things will just fall back on like HTTPX will fall back automatically to like gzip and deflate for compression. So you can fix it quickly if you can't upgrade. I don't know any reason why you wouldn't be able to upgrade but there are a couple ways to mitigate this which basically involve taking care of getting Bratley out of the loop and then taking care of getting this out of your system.

9:26Calvin Hendryx-Parker Again, staying on top of it, How long was this one even like out for? I don't even remember if it noticed in there. Yeah, so the Bratley decoder from 1.0.3 through 1.2 had this in there. And so by default, you don't get a Python that's been compiled with the Bratley C decoder, but you may be bringing in dependencies that do.

9:46Calvin Hendryx-Parker So just to be aware, if you may want to, you run like uv or pip looking for this specific dependency in your projects and make sure, again, you update those dependencies. The show notes have links to all these various things. I just thought I'd kind of give a security roundup in my one segment for all the Python folks out there to stay safe.

10:05Michael Kennedy Calvin, I thought broccoli was good for you.

10:07Calvin Hendryx-Parker Broccoli is normally good for you.

10:09Michael Kennedy It's a bad broccoli.

10:11Calvin Hendryx-Parker It's a bad broccoli.

10:12Michael Kennedy All right, I am so excited about this project that I'm going to introduce. This is my project, something I've been working on all of last week. And I think it's going to be really interesting. And I'm going to show you some numbers. Why? Okay. So I'm sure you're familiar with the Chameleon template language, yes?

10:27Calvin Hendryx-Parker Oh, yeah. I'm a long time like Zoplon pyramid.

10:31Michael Kennedy I'm a big fan. I'm a big fan of it. I like it over Jinja. I like it over Django templates. We don't need to go into why, but let's just say it's a really minimal, nice, clean. Well, the TLDR is with Chameleon, the stuff you write is still valid HTML. With Jinja and Django, you have all this junk in there.

10:50Michael Kennedy Plus, it allows you to write arbitrary Python in those other frameworks, which encourages you to have bad architectural practices, whereas Chameleon is more strict. So now that's why I like it. But it hasn't got a ton of love. If you go back and look at the project, I don't have it pulled up here. Go to pack, look at the Chameleon project to go to the, not the homepage.

11:09Michael Kennedy Go to the repo run by a bunch of people I really like. But if we go over here and look, you can see that like, well, the build is failing and it's only technically built for 3.13. it's still on to you know if you go look at the releases i think in the last i remember summon this up but if you look at the last releases they're all like minor minor bug fix security fix minor minor bug fix like for the last four years right it's just not a whole lot is going on there but could we do a better job and still support that so i introduced to the world chameleon rs like the sportier version of chameleon this is like yeah like if you had a honda accord and And then you're like, well, what if we had the sport edition and we got a new suspension

11:52Michael Kennedy and oh yeah, we also put a turbo on it. You know what I'm like?

11:54Calvin Hendryx-Parker Get the RS badge on the back. That's all you needed.

11:56Michael Kennedy Exactly. It's the RS edition. So Chameleon RS, Chameleon templates modernized. And it's not just faster. If it were just faster, that would be interesting. But let me ask you this. Is Chameleon Python 315T safe? Can I run free threaded Python on Chameleon?

12:12Calvin Hendryx-Parker I'm guessing not.

12:13Michael Kennedy I don't know, but I would guess strongly no if it hasn't even been touched.

12:18Calvin Hendryx-Parker It probably wouldn't work very well.

12:20Michael Kennedy Exactly. I will bet you good odds that there will be some kind of race condition corruption issue. So that's the modernized part, right? Chameleon template is modernized. I want to be able to run regular new Python and expect that my project will work and not just race condition corrupt itself out of existence, especially on a web app that runs for a long time, right?

12:42Michael Kennedy So I rewrote it in Rust and I took every single unit test that Chameleon has and it passes perfectly. I took all of the template tests where it renders them. It's byte for byte HTML identical. I then converted Talk Python and Python bytes to it and requested every single page on old Chameleon and Chameleon RS.

13:05Michael Kennedy They are byte for byte HTML identical. Not just like the same parsable structure, AST. Like every byte comparison, they're the same. How cool is that?

13:15Calvin Hendryx-Parker That's really cool, actually. Great test, too.

13:18Michael Kennedy And then I started doing a bunch of multi-threaded tests, scaling tests, and I'm still running over on my Mac studio. It's running for an hour over there doing some performance testing and looking for any possible issues on the free-threaded stuff. But not just that, more modernized. What if, what if, check this out, in your, let's see, I'll go over here.

13:39Michael Kennedy What if I had markdown content? What do I do with that, Calvin? I don't know. I can't do anything with it in the templates. But Markdown is so insanely common. It's almost HTML, right?

13:49Calvin Hendryx-Parker Yeah.

13:49Michael Kennedy Shouldn't your thing support it? Well, now you just have Markdown colon, some kind of content. And this happens in Rust, which is like 60 times faster than the Python ones. So it's insanely fast. Oh, and one of the really nice benefits of this, I don't know if you've ever, I'm sure you've seen this, how much work you've done with these languages.

14:08Michael Kennedy But when you first deploy your web app and you request a page and it takes like one second for that page to load. And then after that, it's fast. That one second, a lot of it is actually the Chameleon template compiling, Chameleon compiling the template into its actual form. This is 70 times faster compiling the template.

14:27Michael Kennedy So when you deploy it, the first time you touch a page is basically as fast as if it's up and running.

14:33Calvin Hendryx-Parker Wow. And I see you've got HTMX support too. than the perfect world combination.

14:39Michael Kennedy You see, there's more of the modernization. It's not totally HTMX dedicated, but I have three things that I've kind of gone around and I've just, I like poking at trying to make these web frameworks better. So I created Chameleon Flask, which lets me run Chameleon on Flask in a super easy way. You just do like a little template and you put it as a decorator on your Flask thing.

14:57Michael Kennedy Flask will not adopt Chameleon for reasonable reasons, but it's not a crazy good reason. It's like the plugins in Flask expect Jinja, so we can't have any other template. Like, well, it would be nice if we could have other templates on Flask. Also, if you want to do HTMX, having some kind of partial library support is super neat.

15:18Michael Kennedy But Chameleon is not going to add any concept of partials, right? So I took all of these libraries and more, and I built them in Rust, rebuilt them, re-implemented in Rust, and put them inside of Chameleon Artist. So it has native partial support. It has native support for a few frameworks, such as Flask, Quart, FastAPI, Starlette, Robyn, and Litestar and Pyramid.

15:39Michael Kennedy Just out of the box.

15:40Calvin Hendryx-Parker All right, we need to add this to Plone now. We'll get the Plone folks on it.

15:43Michael Kennedy Yeah, yeah, yeah, yeah, absolutely. Plone people wanna work with me. I don't have enough stuff to be able to test it.

15:48Calvin Hendryx-Parker They've got a lot of employment.

15:50Michael Kennedy So here we go, check this out. Compatibility, like you want to switch over. It has, like I said, tons of compatibility, but, oh yeah, it also has an AI skill. So if you go to the docs, it has lm.txt, but also an installable skill. So you can teach your agent just like, hey, you should make this happen.

16:07Michael Kennedy And what was the other? Oh, yes, getting started. So if I want to switch from regular Chameleon, this is like Chameleon, Chameleon partials, all these different pieces. You just import ChameleonRS.compat, compat.install. Boom. That's all you do in your app and everything else is now running the Rust version.

16:26Calvin Hendryx-Parker That's amazing. I'd recommend rewriting it. You have this live now on Talk Python?

16:30Michael Kennedy Yeah, yeah, yeah.

16:31Calvin Hendryx-Parker Nice.

16:31Michael Kennedy And now not only do I have it live, this is the last thing I'm going to say. I'll chill out because I'm really excited about it. This is such a neat thing to be doing. So I switched it. These numbers are off of Talk Python training, okay? So I literally effectively wrote those two lines. I did completely rewrite it to natively take advantage of those things because I have plans.

16:50Michael Kennedy But you could just do the compat thing and basically get this. So the median page response time is 17.6 seconds. sorry, 17.6% faster by just doing that. And pages that are large are 19% faster. Here's a nice graph. Look at this graph before and after.

17:09Calvin Hendryx-Parker Huh, you can see where the change was. Yeah,

17:11Michael Kennedy it's like the thing I'm linking to, you can see the picture, it just drops. And then you go, you can actually see as the pages get bigger, it only gets to be like more useful. And then you can see like the faster and slower. Like in almost every way, this is just more awesome. Even if you don't take advantage of any of the things.

17:27Michael Kennedy Now, I want to point out, this is not, I went and I made some very specific benchmark, like I'm going to return a JSON document that's in memory and then test how fast that goes. Oh, look, it's 20% faster. This is the entire application running. This is all the data access, all the validation, all the e-commerce junk, all the logging, everything, like all the database calls, all of it.

17:52Michael Kennedy And even when you consider the entire app running, it's still 19% faster just by switching that out.

17:57Calvin Hendryx-Parker Speed is a feature. Speed is the feature.

17:59Michael Kennedy All right. Okay. People, if you like Chameleon, check out Chameleon RS. It's pretty awesome.

18:04Calvin Hendryx-Parker Yeah. Well, speaking of speed is a feature, the astral folks have come up with some new fun stuff. That's what I got up next here.

18:11Michael Kennedy Yeah. Let's hear it.

18:12Calvin Hendryx-Parker So it's interesting. So they're experimenting with bringing together some of the astral tools, which I've always loved the fact that astrals kept them kind of like a little bit of the Unix philosophy, like one tool to do one thing and does it really well, where you can kind of pipe them together needed to, but now there's an ability to take them and pull them together to gain another multiplier.

18:33Calvin Hendryx-Parker So the latest release here is bringing uv and TIE together. So this blog post from October 13th, as an experimental integration between uv and TIE available in preview. Now they're asking for feedback on this. And in parallel, they're continuing towards a stable release for TIE itself. So this is all, again, kind of on the maybe bleeding edge, leading edge of the actual tool chain stuff.

18:57Calvin Hendryx-Parker But why does this matter to you? Why should you even care? And one of the things I love, and I didn't really piece this together until I read the blog post, is with PEP 7.23, it allows for the inline scripts, the inline dependencies at the top of the script. So you can see here on the screen, there's an example where they've got the inline where it says what Python it requires and what versions of what dependencies it requires.

19:17Calvin Hendryx-Parker You can have in your library, I didn't think about this, but you can have inside your, if you've got a repository where you're storing a bunch of different scripts, different scripts can actually have different dependencies. And uv handles this very, very cleanly by creating environments for each script individually.

19:33Calvin Hendryx-Parker And now it can take those various environments and use Ty as a language server to do all the validation of your type checking inside of each script individually without kind of running over each other or getting the wrong version of this dependency for that one that's over there. So it's kind of bringing together the best of both worlds here is where you can actually enable this.

19:52Calvin Hendryx-Parker You have to turn it on and then your editor now can be aware of the various versions of the dependencies to make sure that Ty is using the right dependency versions as it builds out the type checking for you in the backside. So it's all opt-in right now. You should definitely check it out. It's powered by the uv workspace metadata.

20:12Calvin Hendryx-Parker So again, another part I didn't really recognize is that uv is maintaining a really rich set of metadata under the covers. And wouldn't it be great if your type checker had access to that same set of metadata so it's bringing together kind of more data to build a better experience for the editors the ide's well ultimately the developer experience benefits from from doing all this so it's working on it's work on this there's some i think there's some more stuff coming soon from them you may see rough getting some integrations as well the tools obviously stay still independent but now they can work more closely together to superpower the developer experience which is really cool that's very cool

20:47Michael Kennedy and it just makes sense to bring you know ty i can see rough coming as well as just a sub command like uv format you know what i mean like why do i need three different commands well and you

20:59Calvin Hendryx-Parker accomplish what the tool suite does right this is this is compatible with uv check so the uv check command and uv pre-commit hooks will also grab the right versions of things and do the right type checking of the bits uh all on the fly for you automatically so it gives you even more reason to use the PEP 723 especially for writing lots of little utility scripts are kind of one-off commands that are meant for consumption by other folks this makes it really easy to to develop those and use

21:25Michael Kennedy type checking uh just seamlessly yeah which is super cool it is super cool uh two things also astral being part of open ai looks like there's still i know people were concerned but it looks like still innovating still innovating still coming on strong and this was independently sent to us by sky casco so thank you for that thanks i think you indic you i think you found it separately but still very very cool they sent that in yeah now my first my first one was kind of intense because i was so excited about it let's do something light i am very excited i am not i will be back i will be back with more to the story but i want to talk about streamlit light so you know what streamlit is yeah you've seen streamlit yeah so streamlit i had adrian on way

22:06Michael Kennedy back before Streamlit was acquired by, I'm sorry, who acquired Streamlit? Snowflake. And the idea is you write basically procedural code and your procedural code is understood by Streamlit and then turned into an interactive dashboard with controls that then change the parameters to your procedural functions you write.

22:27Michael Kennedy It's like if you don't really want to be or are not a visual front-end designer, but you want data science like it has a cool front-end with lots interactivity. I really, really think it's cool. Well, like Jupyter, it requires a server. So this STLite by witphx, I don't know, is basically streamlit in the browser, which is pretty sweet.

22:49Michael Kennedy So similar to what you might get with JupyterLite. And it's really interesting because it's not just, oh, look, you can run it. It's obviously based on Pyodide, which is solid. I just did a Talk Python episode recorded, not yet published with the Cloudflare team about Python Cloudflare edge workers. And a couple of the folks who are building that and who built that are Pyodide core developers.

23:12Michael Kennedy So Pyodide is going strong, which is really cool. So what I can do is I can come up and just create a Streamlit app that you can share. But look at this, Calvin, a desktop app.

23:22Calvin Hendryx-Parker Nice.

23:22Michael Kennedy So the desktop app basically creates an Electron.js version.

23:27Calvin Hendryx-Parker Oh, that's cool.

23:27Michael Kennedy then host your WASM streamlet app in PyDyde running locally with, I believe, local data access, which is why it would be interesting.

23:35Calvin Hendryx-Parker Yeah. Yeah. I wonder what the speed's like. I don't know if you've demoed any of this.

23:39Michael Kennedy Yeah. I don't know, actually. Yeah. I don't know. WebAssembly is pretty quick these days, but who knows? It integrates with React, which is cool. You can drop it into your own page. And so you just have to do things like add a style sheet and then just include the JavaScript module, which then pulls in the WASM, and then you just have a streamlet-app inline your Python, and you're good to go.

24:01Michael Kennedy Anyway, I think this is really cool. I'm a fan of these in the browser things. So often it's like, well, how do I share this thing I built with somebody? It's like, what if I could put it on a static file server? Netlify or something like that.

24:13Calvin Hendryx-Parker Yeah, I like the offline desktop executable mode as well. You can build an app, you can just So app bundle you can hand someone or an exe that someone can just run without any other dependencies.

24:24Michael Kennedy Yep. Yep. It's pretty straightforward. It just gives you all the little bits that you need and off it goes. I would like to point out one thing for people out there working on projects or if they're listening. Here's an app out of visual, a visual thing like a data dashboard in a desktop app. There's not one picture here.

24:41Calvin Hendryx-Parker Goodness. Yeah.

24:43Michael Kennedy Screenshots, people. Screenshots. Get us excited. I mean, just you already got the thing. Just screenshot it. Anyway, that's it. that's it for my items. How extra are you feeling?

24:51Calvin Hendryx-Parker I'm feeling like I've got a couple extras. One of them is a shout out to another podcast. Given the security elements I talked about at the beginning of this episode, if you wanted to hear more, you should definitely check out the Real Python podcast. They had Seth Larson on talking about the future of Python security.

25:07Calvin Hendryx-Parker So definitely check that out. I think security is obviously becoming more and more and more prevalent in our day-to-day lives as developers. So there's another good reason to go talk about it. And then another little just announcement is that the Python Software Foundation wikis have moved to GitHub pages, which I think is probably a great move.

25:26Calvin Hendryx-Parker So PSF wiki, the Python wiki, and the Jthon wiki are now over on GitHub itself. So if you click on that, you are now in a GitHub powered wiki, which is pretty cool. They look good.

25:37Michael Kennedy And I'm pretty psyched to see that on a subdomain of python.org where it belongs.

25:41Calvin Hendryx-Parker Yeah, yeah, for sure. I think you saw that the links they were to psf.github.io but then it looks like they've got a redirect in

25:47Michael Kennedy place to get the nice canonical name yeah probably that was already on the just the GitHub pages and they're like let's get our own domains or put out just not even get the domain just set up the dns

25:56Calvin Hendryx-Parker for a subdomain yep so i'm glad they're taking care of things keeping the project running very

26:01Michael Kennedy strong awesome awesome is that it yep that's it for me cool so i just want to i was going to just talk about this php to shell thing one more time this could just be some schadenfreude like not Python. It could be, actually, this could be a good reason to help convince your boss or decision makers that you should migrate from PHP to Python.

26:20Michael Kennedy Also good. But this is going to have some serious effects on all of us because it's taking over so many systems that have our personal data, which is not ideal. So OpenAI, of all places, actually released a checker for people who happen to be in the PHP land or maybe Python people, but you're like, oh yeah, we also maintain these PHP things.

26:40Michael Kennedy You're self-hosting something. you can run OpenAI's PHP2 shell dash checker and figure that out. Okay, enough of...

26:48Calvin Hendryx-Parker It's a rough week for PHP folks. That one was brutal.

26:52Michael Kennedy Yes. So the next thing is I want to talk about Talk Python membership. A bunch of people signed up. Thank you so much. Please consider signing up. You can do so for as little as five bucks a month. And it's not just free ad-free stuff. The next meetup, the Talk Python tech talk coming up, is going to be by me, Talk Python in production.

27:10Michael Kennedy building your own Python infrastructure and running it. This, if you've heard me talk about this before, this is not going to be the same thing. I have some crazy new things like Chameleon RS, but some other stuff as well that will surprise people. So I'm just going to leave it there. Come check it out.

27:26Michael Kennedy And I also want to announce that it was going to be this Wednesday, but it's going to be a week later. I reschedule it because I want to coordinate a few more things and get some of these ideas, these new ideas, and you're making it a little more useful for people. So talk with a membership, be part of it.

27:39Michael Kennedy See you there.

27:40Calvin Hendryx-Parker Very cool. I've seen all the people joining.

27:41Michael Kennedy Yeah, thanks. They are. Now, I also want to give a quick shout out to who sent this in. This comes to us from Vincent Paolo. And we talked about ZeroVerb projects before on the show at the numeralzerover.org. Are you familiar with this, Calvin?

28:02Calvin Hendryx-Parker No, I'm not, actually.

28:03Michael Kennedy Oh, my gosh. Let's go to the top real quick. So this is like, it's just sort of calls out this open source trend.

28:12Calvin Hendryx-Parker It's a board that outs people with zero version.

28:15Michael Kennedy Yes, yes. Okay, so we talked about it before, but probably a lot of people aren't familiar with it. So the idea is like...

28:22Calvin Hendryx-Parker Oh my goodness. Like some of the ones that are listed here, you're like, wait a minute, these should be released.

28:27Michael Kennedy Exactly. And the reason I think people really started going off on this, I think Mahmoud Hashemi went off on it for a while, is for people in open source, like yeah whatever okay it's 0.2 that's pretty you know it must be be good for a while but as a i just told people like hey you get move off of php to python if you can that would be nice well maybe a tech lead who is like more from i don't know the microsoft space or something where where everything you know like you don't use a microsoft product until it's version 3.0 or later because it's not tested yet you know what i mean you're like it's 0.2 kill it with fire get it away from you know and so there may be some actual friction to adoption of these projects because they are zero

29:08Calvin Hendryx-Parker over okay that's not in every case because i just i just sorted the table by first released something released in 1987 that everyone uses get text is still a zero over project unreal so i think the thing that um 39.8 years zero the thing that vincent pointed out to me is like

29:28Michael Kennedy There's a notable zero for projects. Like, you know what? These are the ones that are really well known. Like, I love Excalibur. It's five years old. It's 0.18. Stuff you may have heard of. FastAPI, brand new. 0.162. Eight years old. NeoVim, that old thing's only 11 years old. It's only 0.12. Hugo, Ruff, for example.

29:51Michael Kennedy Is Ruff only 0.17? Come on, you know? Zig, I mean, okay, Zig's kind of new. But there are a lot of projects.

29:57Calvin Hendryx-Parker One on the list from 1978.

30:01Michael Kennedy You know what? It's okay to just go 1-0 at some point.

30:02Calvin Hendryx-Parker You should just 1-0. And it's 0.9.8.

30:06Michael Kennedy It's so close.

30:07Calvin Hendryx-Parker It's so close to 1.

30:09Michael Kennedy Anyway, I just thought it was the notable ones. I thought, okay, it's time to revisit the notable. And if you have a project that's been out there for a few, look, if your project has been out for 11 years, I don't care if it's 0.8 or it's 1.0. You have a commitment to a stable API, whether you like it or not.

30:26Michael Kennedy You know what I mean?

30:27Calvin Hendryx-Parker Come on, NeoVim. Come on, NeoVim.

30:29Michael Kennedy Just do it. Get off the list.

30:31Calvin Hendryx-Parker It's been 11 years. It's been 11 years. We can do this.

30:33Michael Kennedy The list of shame. All right. Also, I want to give a quick shout out to Python 3.15.2. You called it out for security, but I'm just going to do a quick scroll and point out two things. Just watch how long the scroll bar goes here, Calvin.

30:46Calvin Hendryx-Parker God, goodness. They're busy.

30:48Michael Kennedy These are pages and pages and pages of fixes. And then we get to 3.15.1, which I don't think anyone talked about. This was six days ago. and you scroll and it's pages and pages and pages and pages. I don't know, 20, 30 pages of one sentence fixes, one sentence fixes. Like insane amount of it. So if you're using 315 and you've been waiting for some stuff to get polished, well, it's pretty polished.

31:11Michael Kennedy And also if you're not on.2, you want to update not just because of the security stuff, but because of all these other changes as well.

31:18Calvin Hendryx-Parker I'll go out on a limb. It's safe. I think you're good to go there.

31:20Michael Kennedy Yes, I think you're probably good to go. It's good stuff. Unless you have some very rare wheels are not ready or something, but generally safe. All right, it's time for a joke. How do you feel about captchas?

31:30Calvin Hendryx-Parker No, don't like them.

31:31Michael Kennedy I hate captchas so much. I got banned from discord. I tried to create a second account. I didn't get my regular account banned. I got my second account banned because what I wanted to do is as part of the talk Python membership, I wanted to on another computer, log in and watch the video channel so I could screen record it and then make it available as a recording.

31:52Michael Kennedy And discord doesn't do that on its own. Right? Well, I tried to do that. Just log in and twice in my account. So I went to one that would pull me out of the other videos. Like, oh, you're going to be in two places at once. That's not going to work. We're going to take you out. Like, no, like this is exact.

32:04Michael Kennedy So I tried to make a new account. It made me do the capture 17 times. I'm pretty sure I got it right. At least 16, not just once, you know, you go through three stages of show, find the bridges, find the, um, find all the things that can walk on four legs or whatever, and I went through all of them over and over and over.

32:21Michael Kennedy And then I got it. I finally got logged in and I tried to join the room. And the next thing I got is an email from Discord saying, you're banned for suspicious behavior, probably for trying to hack the captcha. But it just kept coming up and up. I'm like, I'm just please let me by. I don't understand.

32:36Michael Kennedy It's like 10 minutes of captcha loops.

32:38Calvin Hendryx-Parker Anyway, at that point, they should be paying you.

32:39Michael Kennedy I know. I know. So the joke is captcha. It's too real. So this one is a slightly different captcha. It's a captcha with a disassembled sort of really gnarly thing. i don't even know what language this is but a bunch of code doing like some crazy stuff and the captcha is select all the squares with bugs if there are none click skip what do you think about this genius it's diabolical is what it is yeah just what does this print 27 three times okay you can you can access the website too real too real find all the bugs well played well played well played well played recapture people well played well calvin well played for been real fun episode yeah and yeah always good to be here with you thanks for

33:28Michael Kennedy everything thank you everyone for listening and we'll talk to you next week bye